kernel BUG in jffs2_sum_write_sumnode

Status: upstream: reported on 2026/08/15 05:15
Reported-by: syzbot+48f2d47f83a4c223ad14@syzkaller.appspotmail.com
First crash: 63d, last: 15d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[RFC PATCH] jffs2: disable empty summaries instead of calling BUG() 1 (1) 2026/10/15 14:53
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in jffs2_sum_write_sumnode (2) prio:high jffs2 -1 C 9 6d23h 40d 0/29 upstream: reported C repro on 2026/09/06 12:10
linux-6.6 kernel BUG in jffs2_sum_write_sumnode -1 1 29d 29d 0/2 upstream: reported on 2026/09/17 08:59
upstream kernel BUG in jffs2_sum_write_sumnode jffs2 -1 4 915d 917d 0/29 auto-obsoleted due to no activity on 2024/07/23 08:54

Sample crash report:
jffs2: notice: (7913) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
jffs2: warning: (7913) jffs2_sum_write_sumnode: Empty summary info!!!
------------[ cut here ]------------
kernel BUG at fs/jffs2/summary.c:868!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 7913 Comm: syz.2.806 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : jffs2_sum_write_sumnode+0x1bcc/0x1bd8 fs/jffs2/summary.c:867
lr : jffs2_sum_write_sumnode+0x1bcc/0x1bd8 fs/jffs2/summary.c:867
sp : ffff8000214e66a0
x29: ffff8000214e67e0 x28: ffff0000cb7fc000 x27: 000000000000105c
x26: 0000000000000ff4 x25: ffff0000cb7f8558 x24: ffff0000d0b8b300
x23: ffff0000cb7fc5a8 x22: ffff8000214e6700 x21: 0000000000000000
x20: ffff0000f7030570 x19: dfff800000000000 x18: 000000000000004f
x17: 6e69207972616d6d x16: ffff800011bb65f8 x15: 203a65646f6e6d75
x14: 0000000000000001 x13: 1ffff0000429cc3c x12: 0000000000080000
x11: 000000000007ffff x10: ffff80002ac71000 x9 : f9568dc0fcfc5100
x8 : f9568dc0fcfc5100 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000214e6178 x4 : ffff8000154a4e80 x3 : ffff80000a92ec3c
x2 : ffff00019f36dd10 x1 : 0000000100000000 x0 : 0000000000000045
Call trace:
 jffs2_sum_write_sumnode+0x1bcc/0x1bd8 fs/jffs2/summary.c:867
 jffs2_do_reserve_space+0x150/0xd5c fs/jffs2/nodemgmt.c:388
 jffs2_reserve_space_gc+0x60/0xfc fs/jffs2/nodemgmt.c:222
 jffs2_garbage_collect_pristine+0xf4/0xb9c fs/jffs2/gc.c:613
 jffs2_garbage_collect_live+0x570/0x2950 fs/jffs2/gc.c:546
 jffs2_garbage_collect_pass+0x1440/0x1a68 fs/jffs2/gc.c:464
 jffs2_reserve_space+0x36c/0x9e0 fs/jffs2/nodemgmt.c:167
 jffs2_write_inode_range+0x118/0xaf0 fs/jffs2/write.c:362
 jffs2_write_end+0x494/0x1018 fs/jffs2/file.c:301
 generic_perform_write+0x30c/0x508 mm/filemap.c:3873
 __generic_file_write_iter+0x130/0x250 mm/filemap.c:3960
 generic_file_write_iter+0xb4/0x2b0 mm/filemap.c:3989
 do_iter_readv_writev fs/read_write.c:-1 [inline]
 do_iter_write+0x520/0x93c fs/read_write.c:861
 vfs_iter_write+0x88/0xac fs/read_write.c:902
 iter_file_splice_write+0x528/0xa38 fs/splice.c:685
 do_splice_from fs/splice.c:763 [inline]
 direct_splice_actor+0xe4/0x138 fs/splice.c:950
 splice_direct_to_actor+0x3ec/0x9e4 fs/splice.c:896
 do_splice_direct+0x168/0x25c fs/splice.c:1002
 do_sendfile+0x460/0xc8c fs/read_write.c:1255
 __do_sys_sendfile64 fs/read_write.c:1323 [inline]
 __se_sys_sendfile64 fs/read_write.c:1309 [inline]
 __arm64_sys_sendfile64+0x138/0x374 fs/read_write.c:1309
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 910f8000 d005b6a2 9109dc42 97a54f87 (d4210000) 
---[ end trace 0000000000000000 ]---

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/02 06:25 linux-6.1.y 1a8763b93150 6d32eb1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in jffs2_sum_write_sumnode
2026/08/15 05:15 linux-6.1.y e4f7d8be268e 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in jffs2_sum_write_sumnode
2026/08/15 05:14 linux-6.1.y e4f7d8be268e 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in jffs2_sum_write_sumnode
* Struck through repros no longer work on HEAD.